2010-07-12  Steve Block  <steveblock@google.com>

        Reviewed by Alexey Proskuryakov.

        XPath substring function does not correctly handle non-positive values for the position argument
        https://bugs.webkit.org/show_bug.cgi?id=41913

        This patch changes the behavior of the XPath evaluate function when a non-positive
        position argument is supplied and no length argument is supplied. In this case,
        we reset the position to 1. This follows the spec and matches the current behaviour
        when a length argument is supplied.

        Test: fast/xpath/substring-non-positive-postion.html

        * xml/XPathFunctions.cpp:
        (WebCore::XPath::FunSubstring::evaluate):
2010-07-12  Steve Block  <steveblock@google.com>

        Reviewed by Alexey Proskuryakov.

        XPath substring function does not correctly handle non-positive values for the position argument
        https://bugs.webkit.org/show_bug.cgi?id=41913

        * fast/xpath/substring-non-positive-postion-expected.txt: Added.
        * fast/xpath/substring-non-positive-postion.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@63066 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/WebCore/xml/XPathFunctions.cpp b/WebCore/xml/XPathFunctions.cpp
index a727680..41bf795 100644
--- a/WebCore/xml/XPathFunctions.cpp
+++ b/WebCore/xml/XPathFunctions.cpp
@@ -516,11 +516,13 @@
     if (pos > long(s.length())) 
         return "";
 
-    if (haveLength && pos < 1) {
-        len -= 1 - pos;
+    if (pos < 1) {
+        if (haveLength) {
+            len -= 1 - pos;
+            if (len < 1)
+                return "";
+        }
         pos = 1;
-        if (len < 1)
-            return "";
     }
 
     return s.substring(pos - 1, len);